Back to results
US 8,028,160 B1Granted
Data link layer switch with protection against internet protocol spoofing attacks
AssigneeMarvell International Ltd.
InventorMichael Orr
Life of this patent
Estimating the term…
Abstract
A data link layer switch having an associated method and computer program comprises a processor; a plurality of ports to exchange packets of data with a network; a memory to store a switch table; and a packet processor to transfer the packets of data between the ports according to the switch table, the packet processor comprising a classifier to send copies of selected ones of the packets of data to the processor; wherein the processor determines whether an attack upon the data link layer switch has occurred based on the copies of the selected ones of the packets.
Claims49
A data link layer switch comprising:
- a first processor;
- a plurality of ports configured to exchange M packets of data with a network, where M is an integer;
- a memory configured to store a switch table;
- and
- a packet processor that is distinct from the first processor, wherein the packet processor is configured to transfer the M packets of data between the ports according to the switch table, and wherein the packet processor comprises a classifier configured to (i) select N of the M packets of data according to sampling criteria describing the M packets of data without discarding a packet of the M packets and (ii) send N copies of the N selected ones of the M packets of data to the first processor, where N is an integer less than M,
- wherein the first processor is configured to determine whether an attack upon the data link layer switch has occurred based on the N copies,
- wherein the classifier is configured to send the N copies to the first processor prior to the data link layer switch determining whether the M packets of data are associated with an attack,
- wherein the classifier is configured to (i) select the N copies as a representative group of the M packets of data and (ii) transfer the N copies to the first processor prior to threat assessment of the M packets of data by the first processor,
- wherein the first processor is configured to determine whether the M packets of data are associated with an attack based on the N copies, and
- wherein the sampling criteria describing the M packets of data comprise at least one of
- destination addresses of the M packets of data,
- source addresses of the M packets of data,
- identifiers of switch interfaces of the data link layer switch receiving the M packets of data into the data link layer switch,
- identifiers of switch interfaces of the data link layer switch transmitting the M packets of data from the data link layer switch,
- data rates of the M packets of data,
- quantities of data in the M packets of data,
- identifiers of other network devices in paths of the M packets of data, or
- times of occurrence of the M packets of data
- wherein the classifier, when selecting the N of the M packets of data, selects only packets that belong to new data flows based on a table of data flows.
16 more elements
A data link layer switch comprising:
- means for processing;
- port means for exchanging M packets of data with a network, where M is an integer;
- memory means for storing a switch table;
- and
- packet processor means for transferring the M packets of data between the port means according to the switch table, wherein the packet processor means comprises classifier means for (i) selecting N of the M packets of data according to sampling criteria describing the M packets of data without discarding a packet of the M packets and (ii) sending N copies of the N selected ones of the M packets of data to the means for processing, where N is an integer less than M,
- wherein the means for processing determines whether an attack upon the data link layer switch has occurred based on the N copies,
- wherein the means for processing is distinct from the packet processor means, and
- wherein the classifier means sends the N copies to the means for processing prior to the data link layer switch determining whether the M packets of data are associated with an attack,
- wherein the classifier means (i) selects the N copies as a representative group of the M packets of data and (ii) transfers the N copies to the means for processing prior to threat assessment of the M packets of data by the means for processing,
- wherein the means for processing determines whether the M packets of data are associated with an attack based on the N copies, and
- wherein the sampling criteria describing the M packets of data comprise at least one of
- destination addresses of the M packets of data,
- source addresses of the M packets of data,
- identifiers of switch interfaces of the data link layer switch receiving the M packets of data into the data link layer switch,
- identifiers of switch interfaces of the data link layer switch transmitting the M packets of data from the data link layer switch,
- data rates of the M packets of data,
- quantities of data in the M packets of data,
- identifiers of other network devices in paths of the M packets of data, or
- times of occurrence of the M packets of data
- wherein the classifier means, when selecting the N of the M packets of data, selects only packets that belong to new data flows based on a table of data flows.
17 more elements
A method for a data link layer switch comprising a processor, the method comprising:
- exchanging M packets of data with a network, where M is an integer;
- storing a switch table;
- transferring the M packets of data between ports of the data link layer switch according to the switch table;
- selecting N of the M packets of data according to sampling criteria describing the M packets of data without discarding a packet of the M packets;
- selecting N copies of the N selected ones of the M packets of data as a representative group of the M packets of data;
- sending the N copies to the processor prior to the data link layer switch determining whether the M packets of data are associated with an attack, where N is an integer less than M;
- and
- determining via the processor whether an attack upon the data link layer switch has occurred including determining whether the M packets of data are associated with an attack based on the N copies,
- wherein the N copies are transferred to the processor prior to threat assessment of the M packets of data by the processor, and
- wherein the sampling criteria describing the M packets of data comprise at least one of
- destination addresses of the M packets of data,
- source addresses of the M packets of data,
- identifiers of switch interfaces of the data link layer switch receiving the M packets of data into the data link layer switch,
- identifiers of switch interfaces of the data link layer switch transmitting the M packets of data from the data link layer switch,
- data rates of the M packets of data,
- quantities of data in the M packets of data,
- identifiers of other network devices in paths of the M packets of data, or
- times of occurrence of the M packets of data
- when selecting the N of the M packets of data, selecting only packets that belong to new data flows based on a table of data flows.
16 more elements
Memory that stores a program for a data link layer switch, the data link layer switch exchanging M packets of data with a network, where M is an integer, the program comprising instructions for:
- selecting N of the M packets of data according to sampling criteria describing the M packets of data without discarding a packet of the M packets;
- selecting N copies of the N selected ones of the M packets of data as a representative group of the M packets of data;
- sending the N copies to a processor prior to the data link layer switch determining whether the M packets of data are associated with an attack, where N is an integer less than M;
- examining the N copies;
- and
- determining via the processor whether an attack upon the data link layer switch has occurred including determining whether the M packets of data are associated with an attack based on the N copies,
- wherein the N copies are transferred to the processor prior to threat assessment of the M packets of data by the processor, and
- wherein the sampling criteria describing the M packets of data comprise
- destination addresses of the M packets of data,
- source addresses of the M packets of data,
- identifiers of switch interfaces of the data link layer switch receiving the M packets of data into the data link layer switch,
- identifiers of switch interfaces of the data link layer switch transmitting the M packets of data from the data link layer switch,
- data rates of the M packets of data,
- quantities of data in the M packets of data,
- identifiers of other network devices in paths of the M packets of data, and
- times of occurrence of the M packets of data
- when selecting the N of the M packets of data, selecting only packets that belong to new data flows based on a table of data flows.
14 more elements
Dependencies are inferred from the claim text.